Overview

The audit mechanism of OceanBase Database audits specific events by using a series of filters. A filter can filter events by account, event type, and event attribute, and determine whether to audit the events that meet the filter conditions.

Audit functions

The following table describes the audit functions (expressions) supported by OceanBase Database in MySQL mode of the current version.

Limitations and considerations

• An expression must be placed directly and uniquely in an output column of a SELECT statement without being limited by a parent expression. The output column is an item specified in the SELECT statement.

• You cannot write expressions in subqueries.

• After you define a filter, you must configure it for a user to make it take effect.

• One filter corresponds to multiple users. You can configure one filter for multiple users, but one user can have only one filter.

• You must specify an audit filter for a session when you create it. The audit filter applies to the session throughout its lifecycle.

  • Calling the AUDIT_LOG_FILTER_SET_USER or AUDIT_LOG_FILTER_REMOVE_USER function to modify the binding relationship between a filter and a user will not affect the current session.
  • Modifying the definition of a filter or deleting a filter will affect the current session.

• The AUDIT_LOG_FILTER_REMOVE_FILTER function will cascade delete all audit users bound with the filter. The operations of these users will no longer be audited.